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SUBJECT 

California Consumer Privacy Act of 2018: consumer remedies 

DIGEST 


This bill amends the private and consumer enforcement mechanisms in the California 
Consumer Privacy Act (CCPA). The bill also authorizes the Attorney General to 
provide general guidance on compliance with the CCPA. 

EXECUTIVE SUMMARY 


The California Consumer Privacy Act of 2018 (CCPA) provides a very limited consumer 
enforcement mechanism limited to data breaches. Otherwise, the responsibility for 
enforcing the CCPA and holding violators accountable falls completely on the Attorney 
General's Office (AGO). Furthermore, when the AGO uncovers violations of the CCPA, 
the AGO must provide the entity in violation 30 days to "cure" their violations before 
the AGO is authorized to bring an enforcement action. The CCPA also provides that 
any business or third party may seek the legal opinion of the AGO. 

In order to ensure more robust enforcement of the CCPA and to ensure that consumers 
can vindicate their rights, this bill expands the consumer enforcement mechanism, 
enabling consumers to enforce their own rights pursuant to the CCPA. The bill also 
removes the ability for violators to "cure" their violations of the law before the AGO is 
able to hold them accountable through an enforcement action. Finally, in order to avoid 
the potentially massive drain on public resources, the bill modifies the legal opinions 
provision of the law and instead authorizes the AGO to provide general guidance on 
compliance with the law. 

This bill is sponsored by Attorney General Xavier Becerra who contends the bill is 
necessary to ensure "vigorous oversight and effective enforcement" of the CCPA's 
protections. The bill is supported by various consumer groups. A number of business 
and advertising associations are among those in opposition. 
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PROPOSED CHANGES TO THE LAW 


Existing law: 

1) Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants 
consumers certain rights with regard to their personal information, including 
enhanced notice, access, and disclosure; the right to deletion; the right to restrict 
the sale of information; and protection from discriminahonfor exercising these 
rights. It places attendant obligations on businesses to respect those rights. (Civ. 
Code § 1798.100 etseq.) 

2) Provides that any consumer whose nonencrypted or nonredacted personal 
information, as defined, is subject to an unauthorized access and exfiltration, 
theft, or disclosure as a result of the business's violation of the duty to implement 
and maintain reasonable security procedures and practices appropriate to the 
nature of the information to protect the personal information may institute a civil 
achon for any of the following: 

a. to recover damages in an amount not less than $100 and not greater than 
$750 per consumer per incident or actual damages, whichever is greater; 

b. injunctive or declaratory relief; 

c. any other relief the court deems proper. (Civ. Code § 1798.150(a).) 

3) Requires a consumer, before bringing a civil action to enforce the CCPA, to 
provide a business 30 days' written notice identifying the specific provisions of 
the CCPA the consumer alleges have been or are being violated. If possible to 
cure and if within the 30 days the business actually cures the noticed violation 
and provides the consumer a statement indicating the cure and stating no further 
violations shall occur, no action for individual statutory damages or class-wide 
statutory damages may be initiated against the business. No notice shall be 
required prior to an individual consumer initiating an action solely for actual 
pecuniary damages suffered as a result of the alleged violations. If a business 
continues to violate the CCPA in breach of the statement required above, the 
consumer may initiate an action against the business and may pursue statutory 
damages for each breach, as well as other subsequent violations of the CCPA. 
(Civ. Code § 1798.150(b).) 

4) Restricts the cause of action described above from applying to any other 
violation of the CCPA. The CCPA provides that nothing therein shall be 
interpreted to serve as the basis for a private right of action under any other law. 
(Civ. Code § 1798.150(c).) 
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5) Provides that any business or third party may seek the opinion of the Attorney 
General for guidance on how to comply with the provisions of the CCPA. (Civ. 
Code § 1798.155(a).) 

6) Provides that a business shall be in violation of the CCPA if it fails to cure any 
alleged violation within 30 days after being notified of alleged noncompliance. 
Any business, service provider, or other person that violates the CCPA shall be 
subject to an injunction and liable for a civil penalty of not more than $2,500 for 
each violation or $7,500 for each violation that is proven to be intentional. Such 
penalties shall be exclusively assessed and recovered in a civil action brought by 
the Attorney General. (Civ. Code § 1798.155(b).) 

This bill: 

1) Extends the ability of a consumer to bring a civil action when any of the 
consumer's rights under the CCPA are violated. 

2) Authorizes the Attorney General to publish materials that provide businesses 
and others with general guidance on how to comply with the provisions of the 
CCPA. It removes the ability of any business or third party from seeking the 
opinion of the Attorney General. 

3) Removes the ability of a business to cure alleged violations within 30 days of 
notice of a violation before the Attorney General is authorized to bring a civil 
action to enforce the CCPA. 

COMMENTS 

1. Protecting the fundamental right to privacy 

Article I, Section 1 of the California Constitution provides: "All people are by nature 
free and independent and have inalienable rights. Among these are enjoying and 
defending life and liberty, acquiring, possessing, and protecting property, and pursuing 
and obtaining safety, happiness, and privacy." Privacy is therefore not just a policy 
goal, it is a constitutional right of every Californian. However, it has been under 
increasing assault. 

The phrase "and privacy" was added to the California Constitution as a result of 
Proposition 11 in 1972; it was known as the "Privacy Initiative." The arguments in 
favor of the amendment were written by Assemblymember Kenneth Cory and Senator 
George Moscone. The ballot pamphlet stated in relevant part: 

At present there are no effective restraints on the information activities of 

government and business. This amendment creates a legal and enforceable right of 
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privacy for every Californian. The right of privacy . . . prevents government and 
business interests from collecting and stockpiling unnecessary information about us 
and from misusing information gathered for one purpose in order to serve other 
purposes or to embarrass us. . . . The proliferation of government and business 
records over which we have no control limits our ability to control our personal 
lives. . . . Even more dangerous is the loss of control over the accuracy of 
government and business records on individuals. . . . Even if the existence of this 
information is known, few government agencies or private businesses permit 
individuals to review their files and correct errors. . . . Each time we apply for a 
credit card or a life insurance policy, file a tax return, interview for a job[,] or get a 
drivers' license, a dossier is opened and an informational profile is sketched. 1 

In 1977, the Legislature reaffirmed that the right of privacy is a "personal and 
fundamental right" and that "all individuals have a right of privacy in information 
pertaining to them." 2 The Legislature further stated the following findings: 

• "The right to privacy is being threatened by the indiscriminate collection, 
maintenance, and dissemination of personal information and the lack of effective 
laws and legal remedies." 

• "The increasing use of computers and other sophisticated information 
technology has greatly magnified the potential risk to individual privacy that can 
occur from the maintenance of personal information." 

• "In order to protect the privacy of individuals, it is necessary that the 
maintenance and dissemination of personal information be subject to strict 
limits." 

Although written almost 50 years ago, these concerns seem strikingly prescient. Today, 
the world's most valuable resource is no longer oil, but data. Companies regularly and 
systematically collect, analyze, share, and sell the personal information of consumers. 
While this data collection provides consumers various benefits, public fears about the 
widespread, unregulated amassing of personal information have only grown since 
privacy was made a part of California's Constitution. 

In response to growing concerns about the privacy and safety of consumers' data, 
proponents of the CCP A, a statewide ballot initiative, began collecting signatures in 
order to qualify it for the November 2018 election. The goal was to empower 
consumers to find out what information businesses were collecting on them and give 
them the choice to tell businesses to stop selling their personal information, ha response 
to the pending initiative, which was subsequently withdrawn, AB 375 (Chau, Ch. 55, 
Stats. 2018) was introduced, quickly shepherded through the legislative process, and 


1 Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1,17, quoting the official ballot pamphlet for the 
Privacy Initiative. 

2 Civ. Code § 1798.1. 
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signed into law. The outcome was the California Consumer Privacy Act of 2018, Civil 
Code Section 1798.100 et seq. 

The CCPA grants a set of rights to consumers with regard to their personal information, 
including enhanced notice and disclosure rights regarding information collection and 
use practices, access to the information collected, the right to delete certain information, 
the right to restrict the sale of information, and protection from discrimination for 
exercising these rights. 

This bill does not limit or expand these rights; rather, it amends how these rights are 
enforced. 

2. Stated intent of the bill 
According to the author: 

In response to the passage of the CCPA, the Attorney General's Office submitted 
a letter to its authors calling attention to various issues with the provisions 
therein. The letter emphasized that while providing privacy protections is 
"critically important," the CCPA, as it stands, presents "unworkable obligations 
and serious operational challenges." This bill responds to the critical 
enforcement concerns highlighted by the Attorney General with three changes. 

First, SB 561 ensures that the rights created by the CCPA are meaningful by 
authorizing consumers to take control and enforce their own rights. Because a 
right without a remedy is no right at all, we must act now to ensure consumers 
have the ability to enforce this important law. 

Second, the bill eliminates the right to "cure" for violators of the law when the 
Attorney General is bringing an enforcement action. Providing violators this "get 
out of jail free card" undermines meaningful enforcement of the CCPA, weakens 
consumers' rights, and disadvantages honest businesses that comply with the 
law. 

Third, SB 561 protects taxpayers from the burden of providing legal advice to 
any business that wants it, and instead authorizes the Attorney General to 
publish general guidance on complying with the CCPA to benefit all businesses 
and third parties. 

Attorney General Xavier Becerra, the sponsor of this bill, writes: 

While the CCPA provides groundbreaking protections for consumers, it also 
imposes serious workability and operational challenges upon the Attorney General's 
Office (AGO). These challenges will make it difficult for my office to carry out our 
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oversight and enforcement duties under the CCPA. On numerous occasions, I have 
stated on the record that failure to address these flaws in the CCPA will undermine 
California's authority to launch and sustain vigorous oversight and effective 
enforcement of the Act's critical privacy protections. 

3. Enforcement 

The CCPA provides two forms of enforcement: (1) limited consumer enforcement and 
(2) conditional public enforcement by the Attorney General. 

a. Private enforcement 

The CCPA provides consumers the right to bring a civil action for statutory and actual 
damages in only one context, when the consumer's nonencrypted or nonredacted 
personal information, as defined, is subject to an unauthorized access and exfiltration, 
theft, or disclosure as a result of the business's violation of the duty to implement and 
maintain reasonable security procedures and practices appropriate to the nature of the 
information to protect the personal information. Even before such an action can be 
brought, however, the consumer must provide the business 30 days written notice of 
the alleged violation (with certain exceptions) within which the business has the ability 
to "cure" the violation, where possible. 

The CCPA further provides that nothing therein shall be interpreted to serve as the 
basis for a private right of action under any other law. Therefore, outside of the data 
breach context, consumers are unable to directly vindicate their rights under the law. 

For instance, if a business is collecting the personal information of a young child 
without the parent or guardian's consent, the child and the child's parent or guardian 
are currently without a remedy under the CCPA. 

The Attorney General addresses this weakness in consumer enforcement: 

[T]he CCPA does not include a private right of action that would allow consumers 
to seek legal remedies for themselves and broadly enforce their privacy rights under 
the Act. Instead, the Act only gives consumers a limited right to sue if they become 
a victim of a data breach. There is something unfair about giving California's 
consumers new rights but denying them the ability to protect themselves if those 
rights are violated. The lack of a private right of action, which would provide a 
critical adjunct to governmental enforcement, will substantially increase the AGO's 
need for new enforcement resources. 

SB 561 responds to these concerns by strengthening consumer enforcement. It 
empowers a consumer whose rights under the CCPA are violated to institute a civil 
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action against those responsible. The bill therefore affords consumers access to justice 
by providing them the ability to vindicate their rights for all violations of the CCPA. 

It should be noted that this change to the consumer enforcement mechanism does not 
modify the existing right to "cure" that businesses alleged to have violated the CCPA 
are afforded before a consumer can initiate a civil action. 

b. Public enforcement 

Outside of the above context, enforcement responsibilities are entirely the realm of the 
Attorney General. The CCPA provides that a business, service provider, or other 
person that violates its provisions may be subject to an injunction and civil penalties in 
a civil action brought in the name of the people of the State of California by the 
Attorney General. 

However, before the Attorney General can hold a responsible party accountable for a 
violation of the CCPA through a civil action, the alleged violator must be provided with 
notice of the violation and given 30 days to cure any alleged violation. Essentially, a 
violation of the CCPA is not considered a violation until it remains uncured for 30 days 
from the point it was notified it was in violation. 

The Attorney General has expressed grave concerns with providing businesses that 
violate the law with an ability to avoid accountability: 

[T]he right-to-cure provision unfairly disadvantages honest businesses that comply 
with the law in the first place. The right to cure potentially incentivizes companies 
to break the law as a business decision, on the theory that fixing a violation will cost 
less than complying with the law in the first instance. Taking into account the low 
probability that their particular violation will immediately be detected and 
investigated by the AGO, some companies may decide it is an acceptable cost of 
doing business to ignore the law's requirements if they have the right to cure the 
violation before facing liability for the decision. 

In the end, honest businesses that bear the costs associated with early compliance 
are disadvantaged, not rewarded. Meanwhile, Californians' privacy rights under 
the CCPA are jeopardized by businesses that choose not to follow the law unless or 
until they are given a notice and opportunity to cure. It is unfair to put someone at a 
competitive disadvantage because they chose to play by the rules. 

This bill removes this provision. The Attorney General is entrusted by the people of 
California to exercise discretion in which crimes to prosecute and which violations of 
the law will be investigated and enforced with the resources of the office. This 
amendment to the CCPA acknowledges that fact. Given the limited resources and the 
scope of the oversight, the AGO is arguably more likely to focus its resources on larger, 
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systematic violators of the CCPA. Allowing such bad actors to avoid accountability 
after the AGO has conducted a thorough investigation undermines the public 
enforcement mechanism in the law. This bill avoids that pitfall and removes the right to 
"cure" as to the public enforcement mechanism. 

4. Attorney General's legal guidance 

The CCPA provides that "[a]ny business or third party may seek the opinion of the 
Attorney General for guidance on how to comply with the provisions of [the CCPA]." 
Although the language of this provision is slightly ambiguous, this provision may be 
interpreted to require the Attorney General to act as legal counsel for every entity that 
seeks it out in relation to CCPA compliance. Essentially, the very parties that may be in 
violation of the CCPA and that the Attorney General may be investigating, would be 
able to seek legal guidance from the Attorney General regardless of the resources 
available to them. 

Under such a reading, large corporations could requisition the Attorney General as 
their own private legal counsel despite having ample resources with taxpayers paying 
the price. The Attorney General discusses his concerns with this provision: 

Expecting the AGO to provide legal counsel at taxpayers' expense to all inquiring 
businesses would be unprecedented. The AGO is not in the practice of using public 
funds to provide unlimited legal advice to private parties. This provision also 
creates a potential conflict of interest were the AGO to provide legal advice to 
parties who may be violating the privacy rights of Californians, the very people that 
the AGO is sworn to protect. What could be more unfair and unconscionable than 
to advantage violators of consumers' privacy by providing them with legal counsel 
at taxpayer expense but leaving the victims of the privacy violation on their own? 

SB 561 reworks this ambiguous provision of the CCPA to instead authorize the 
Attorney General to publish materials that provide businesses and other third parties 
with general guidance on how to comply with the CCPA. 

5. Stakeholder positions on the bill 

Consumer Watchdog explains its support for the bill: 

First, because a right without a remedy is really no right at all, SB 561 ensures that 
consumers may seek justice and enforce their rights through civil actions for all 
violations of the CCPA. Second, SB 561 closes the loophole that allowed businesses 
to avoid accountability under the CCPA by removing the 30-day right to cure 
provision. Third, SB 561 authorizes the Office of the Attorney General to publish 
general CCPA compliance guidance to the benefit of all businesses and third parties. 
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Oakland Privacy and Media Alliance write in support of the bill, stating it "will go a 
long way towards polishing California's Consumer Privacy Act into a more workable 
and effective piece of legislation that will protect consumers in an era of declining data 
security." 

Writing in support, Consumer Reports states: 

This bill would address significant weaknesses in the CCPA. Consumer Reports 
took a "support if amended" position on AB 375 in 2018 in large part because of its 
weak enforcement provisions. The CCPA currently lacks sufficient enforcement to 
ensure that it is truly meaningful for consumer privacy. We are particularly troubled 
by the "right to cure" provision included in the legislation which, depending on 
how it is interpreted, may enable a business to evade all liability for behavior 
proscribed by the statute if it remedies its behavior within 30 days of receiving 
notice of noncompliance. Under this provision, a company might be able to 
flagrantly violate the law, and only cease its behavior once its privacy-invasive 
practices were discovered. Companies should not have to receive legal notice from 
the Attorney General before being legally responsible for following the law. 

The Civil Justice Association of California, an association of businesses including Dow 
Chemical Company, PG&E, Monsanto, and Shell Oil Company, writes in opposition to 
the bill. It argues that the bill would "vastly broaden the right of consumers to sue for 
violations of California's newly-enacted California Consumer Privacy Act (CCPA)." 
They argue changes such as these should be addressed at a later time. 

In addition, a coalition of advertising associations writes in opposition. They argue that 
"eliminating businesses' ability to seek the California Attorney General's advice on 
ways to comply with the CCPA will cripple important, privacy-advancing 
conversations regulators and regulated entities could have about the law." However, 
the bill does not prevent these conversations from taking place, but rather eliminates 
the possible legal mandate for the taxpayer-funded AGO to provide individualized, 
legal advice for every corporation and businesses in California, ha fact, the AGO has 
been actively engaged with businesses and other stakeholders across the state as it 
carries out its informal rulemaking process. Forums have been held throughout 
California and the AGO has solicited feedback from a diverse array of parties. These 
conversations will continue to happen as the AGO executes its regulatory functions. 

The advertising coalition further argues that eliminating the cure period with respect to 
AGO enforcement removes a "powerful way to incentivize businesses to quickly adjust 
their practices to meet the CCPA's requirements." However, the exact opposite 
conclusion is arguably more likely. The ability to cure before being penalized by the 
Attorney General may actually incentivize businesses not to comply with the CCPA 
where it benefits them and simply rely on the ability to cure if their violations are 
discovered by the Attorney General. Arguably, the ability of consumers and the AGO 
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to enforce the law without conditions is an even stronger incentive for businesses to 
follow the law. 

Finally, there have been a number of opponents to the bill that argue the expansion of 
the consumer enforcement mechanism breaks the "deal" that was made on the CCPA in 
2018. From a constitutional perspective, one legislative body cannot limit or restrict its 
own power or that of subsequent Legislatures, and the act of one Legislature does not 
bind its successors. (In re Collie (1952) 38 Cal. 2d 396, 398, cert, denied, (1953) 345 U.S. 
1000.) The power to legislate includes by necessary implication the power to amend 
existing legislation, and the amendment of a legislative act is itself a legislative act. 

(City ofSausalito v. County of Marin (1970) 12 Cal. App. 3d 550, 563-564.) 

From a policy perspective, concerns about the operability of a law intended to benefit 
California's consumers is arguably a sound basis to revisit any statute, previous 
agreements notwithstanding. Furthermore, the original initiative had a far broader 
consumer enforcement mechanism than that being proposed by this bill. The relevant 
provision read: 

1798.108. Enforcement By Consumers Who Have Suffered An Injury In Fact. 

1798.108. (a) A consumer who has suffered a violation of this Act may bring an 
action for statutory damages. For purposes of Business and Professions Code 
section 17204 and any other applicable law, a violation of this Act shall be 
deemed to constitute an injury in fact to the consumer who has suffered the 
violation, and the consumer need not suffer a loss of money or property as a 
result of the violation in order to bring an action for a violation of this Act. 

(b)(1) Any consumer who suffers an injury in fact, as described in subdivision (a) 
of this section, shall recover statutory damages in the amount of one thousand 
dollars ($1,000) or actual damages, whichever is greater, for each violation from 
the business or person responsible for the violation, except that in the case of a 
knowing and willful violation by a business or person, an individual shall 
recover statutory damages of not less than one thousand dollars ($1,000) and not 
more than three thousand dollars ($3,000), or actual damages, whichever is 
greater, for each violation from the business or person responsible for the 
violation. 

The initiative received far more than the minimum amount of signatures it needed, and 
proponents of the initiative have indicated the ballot measure was overwhelmingly 
supported by California's voters with this broad enforcement provision in it. This 
sentiment has been reinforced by a recent ACLU/Binder Research poll. The poll 
focused on Californians' positions on privacy legislation. Relevant here, the poll found 
that "94% want the right to take a company to court if they violate their privacy 
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rights." 3 The evidence therefore supports the position that people want to be able to 
enforce their own rights. 

The deal was negotiated on behalf of the people of California. The CCPA provides a 
number of rights to Californians as a part of the "deal" negotiated on their behalf. 
However, it does not provide Californians the ability to take a company to court when 
their privacy rights are violated, an ability that 94 percent of Californians desire. This 
bill gives Californians what they want. 


SUPPORT 


Attorney General Xavier Becerra (sponsor) 

Consumer Attorneys of California 

Consumer Federation of California 

Consumer Reports 

Consumer Watchdog 

Media Alliance 

Oakland Privacy 


OPPOSITION 


Advanced Medical Technology Association 

Alliance of Automobile Manufacturers 

American Advertising Federation 

American Association of Advertising 

Association of National Advertisers 

CALASLAN Chamber of Commerce 

California Association of Collectors 

California Association of Licensed Investigators 

California Bankers Association 

California Business Properties Association 

California Cable & Telecommunications Association 

California Chamber of Commerce 

California Communications Association 

California Community Banking Network 

California Credit Union League 

California Fuels & Convenience Alliance 

California Grocers Association 

California Hospital Association 

California Life Sciences Association 


3 Jacob Snow, Will California lawmakers vote to protect Californians' privacy or tech industry profits? (March 27, 
2019) ACLU, https:// www.aclunc.org/blog/will-california-lawmakers-vote-protect-californians- 
privacy-or-tech-industry-profits [as of Apr. 6,2019]. 
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California Land Title Association 
California Manufacturers & Technology Association 
California Mortgage Bankers Association 
California New Car Dealers Association 
California News Publishers Association 
California Restaurant Association 
California Retailers Association 
Card Coalition 

Civil Justice Association of California 

Cemetery and Mortuary Association of California 

CompTIA 

Connected Commerce Council 
Consumer Data Industry Association 
Consumer Technology Association 
CTIA 

Email Sender & Provider Coalition 
Engine Advocacy 

Entertainment Software Association 

Global Automakers 

Insights Association 

Interactive Advertising Bureau 

International Franchise Association 

Internet Association 

Internet Coalition 

Investment Company Institute 

Motion Picture Association of America 

National Business Coalition on E-Commerce & Privacy 

National Federation of Independent Business 

National Payroll Reporting Consortium 

NetChoice 

Network Advertising Initiative 
Plumbing Manufacturers International 
San Diego Gas & Electric 

Satellite Broadcasting and Communications Association 

Securities Industry and Finance Markets Association 

Southern California Gas Company 

State Privacy & Security Coalition 

Software & Information Industry Association 

TechNet 

The Toy Association 
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RELATED LEGISLATION 


Pending: 

SB 753 (Stern, 2019) provides that a business does not sell personal information if the 
business, pursuant to a written contract, shares, discloses, or otherwise communicates 
to another business or third party a unique identifier only to the extent necessary to 
serve or audita specific advertisement to the consumer. The bill requires the contract to 
prohibit the other business or third party from sharing, selling, or otherwise 
communicating the information except as necessary to serve or audit advertisement 
from the business. This bill is currently in the Senate Rules Committee. 

AB 25 (Chau, 2019) excludes from the definition of "consumer" in the CCPA a natural 
person whose personal information has been collected by a business in the course of a 
person acting as a job applicant or as an employee, contractor, or agent, on behalf of the 
business, to the extent their personal information is used for purposes compatible with 
the context of the person's activities for the business as a job applicant, employee, 
contractor, or agent of the business. The bill states the intent to further clarify how a 
business shall comply with requests for specific pieces of information. This bill is 
currently in the Assembly Privacy and Consumer Protection Committee. 

AB 288 (Cunningham, 2019) provides that when a user of a social networking service 
deactivates or deletes the user's account, the service shall provide the user the option of 
having the user's personally identifiable information permanently removed from any 
database controlled by the service, from the service's records, and to prohibit the service 
from selling that information to, or exchanging that information with, a third party in 
the future. Consumers are authorized to bring civil actions for damages that occur as a 
result of violations of the bill, including attorney's fees, pain and suffering, and punitive 
damages, as specified. This bill is currently in the Assembly Privacy and Consumer 
Protection Committee. 

AB 846 (Burke, 2019) amends the non-discrimination provisions of the CCPA. It also 
removes the prohibition on businesses' use of financial incentive practices that are 
unjust or unreasonable. It also clarifies that loyalty and rewards programs are not 
restricted by the CCPA. This bill is currently in the Assembly Privacy and Consumer 
Protection Committee. 

AB 873 (Irwin, 2019) loosens the definition of "deidentified" and narrows the definition 
of "personal information" in the CCPA. It removes from the definition of "personal 
information" information that can identify a particular household. It also removes the 
requirement that a business reidentify or otherwise link certain information for 
purposes of the CCPA. This bill is currently in the Assembly Privacy and Consumer 
Protection Committee. 
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AB 874 (Irwin, 2019) amends the definition of "personal information" in the CCPA. It 
removes the application of the CCPA to publicly available information that is used for a 
purpose that is not compatible with the purpose for which the data is maintained and 
made available in government records or for which it is publicly maintained. This bill is 
currently in the Assembly Privacy and Consumer Protection Committee. 

AB 950 (Levine, 2019) requires a business that conducts business in California and that 
collects a California resident's consumer data to disclose to the consumer the monetary 
value to the business of their consumer data through various methods. If the data is 
sold, the business is required to disclose the average and actual price that is paid. The 
bill also establishes the Consumer Data Privacy Commission to provide guidance to the 
Legislature and to submit a report regarding appropriate metrics and methodology for 
determining the monetary value of consumer data. This bill is currently in the 
Assembly Privacy and Consumer Protection Committee. 

AB 981 (Daly, 2019) exempts from the protections and provisions of the CCPA 
insurance institutions, agents, insurance-support organizations, or insurance 
transactions, as specified. This bill is currently in the Assembly Privacy and Consumer 
Protection Committee. 

AB 1138 (Gallagher, 2019) prohibits a person or business that conducts business in 
California, and that operates a social media website or application, from allowing a 
person under 16 years of age to create an account with the website or application unless 
the website or application obtains the consent of the person's parent or guardian before 
creation of the account. This bill is currently in the Assembly Privacy and Consumer 
Protection Committee. 

AB 1146 (Berman, 2019) exempts from the protections and provisions of the CCPA 
vehicle information, including ownership information, shared between a new motor 
vehicle dealer and the vehicle's manufacturer, if the vehicle information is shared 
pursuant to, or in anticipation of, a vehicle repair relating to warranty work or a recall, 
as specified. This bill is currently in the Assembly Privacy and Consumer Protection 
Committee. 

AB 1202 (Chau, 2019) requires data brokers to register with, and provide certain 
information to, the Attorney General. Such information must be made publicly 
accessible. This bill is currently in the Assembly Appropriations Committee. 

AB 1355 (Chau, 2019) amends the definitions of "publicly available" and "personal 
information." This bill is currently in the Assembly Privacy and Consumer Protection 
Committee. 

AB 1395 (Cunningham, 2019) prohibits a smart speaker device, or a smart speaker 
device manufacturer, from saving or storing recordings of verbal commands or requests 
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given to a smart speaker device, or verbal conversations heard by the smart speaker 
device, regardless of whether the smart speaker device was triggered using a key term 
or phrase. This bill is currently in the Assembly Privacy and Consumer Protection 
Committee. 

AB 1416 (Cooley, 2019) expands the exemptions within the CCPA, specifically including 
additional conduct that a business is able to engage in without restriction from the 
CCPA. This includes the ability to disclose personal information to assist another 
person to exercise legal claims and to protect against fraud or unauthorized 
transactions. This bill is currently in the Assembly Privacy and Consumer Protection 
Committee. 

AB 1564 (Berman, 2019) reduces the methods a business must make available to 
consumers for submitting requests for information required to be disclosed pursuant to 
the CCPA. It removes the requirement that a business provide a toll-free telephone 
number for such purposes. This bill is currently in the Assembly Privacy and 
Consumer Protection Committee. 

AB 1760 (Wicks, 2019) renames the CCPA the California Privacy for All Act of 2019 and 
strengthens various protections for consumers, including a change from opt-out consent 
for the sale of information to opt-in consent for the sharing of information. The bill also 
includes data minimization requirements and modifies various definitions. The bill 
expands the consumer enforcement mechanism within the CCPA, providing for a right 
of action for all violations of the CCPA and eliminating the right to cure. It also 
explicitly allows district attorneys, city attorneys, and county counsel to bring actions 
on behalf of the people for violations of the CCPA in addition to the Attorney General. 

It also removes the provision regarding the legal opinions of the Attorney General. This 
bill is currently in the Assembly Privacy and Consumer Protection Committee. 

Prior: 


AB 375 (Chau, Ch. 55, Stats. 2018) See Comment #2. 

SB 1121 (Dodd, Ch. 735, Stats. 2018) amended the CCPA to make technical fixes and to 
address various stakeholder concerns. 


* * * * * * * * * * * * * * 



